CVE-2013-4259

Ansible < 1.2.3 - Session Hijacking via Symlink Attack on ControlPersist Socket

Title source: llm
STIX 2.1

Description

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

References (3)

Core 3
Core References
Issue Tracking, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=998223
Vendor Advisory x_refsource_confirm
http://www.ansible.com/security

Scores

EPSS 0.0034
EPSS Percentile 26.3%

Details

CWE
CWE-264
Status published
Products (2)
pypi/ansible 0 - 1.2.3PyPI
redhat/ansible < 1.2.2
Published Sep 16, 2013
Tracked Since Feb 18, 2026